Detection rules › Splunk
Unusual HTTP Download (Sysmon)
Detects possible malicious download which was made using a browser or wget over the http or https protocol.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1071.001 Application Layer Protocol: Web Protocols, T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 3 | Network connection |
| Sysmon | Event ID 15 | FileCreateStreamHash |
Rule body yaml
id: '1045.1073'
title: Unusual HTTP Download
description: Detects possible malicious download which was made using a browser or
wget over the http or https protocol.
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https"
OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe"
OR "opera.exe" OR "MicrosoftEdge.exe"))| table _time, host, user, host, dest_ip,
src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature,
user, direction, protocol| bin span=60s | stats values(*) as * by _time, host |
table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id,
process_name, process_path, signature, direction, protocol `hec_collect`'
techniques:
- command-and-control:ingress tool transfer
- command-and-control:application layer protocol:web protocols
technique_id:
- T1105
- T1071.001
data_category:
- Windows Sysmon
references: null
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` ((EventCode=3 (protocol="https" OR protocol="http"))) OR (EventCode=15 AND ("chrome.exe"OR "firefox.exe" OR "iexplorer.exe" OR "opera.exe" OR "MicrosoftEdge.exe"))
Stage 2: table
| table _time, host, user, host, dest_ip, src_ip, dvc, tag, process_*, event_id, dest_port, src_port, dvc_nt_host, signature, user, direction, protocol
Stage 3: bucket
| bin span=60s
Stage 4: stats
| stats values(*) as * by _time, host
Stage 5: table
| table _time, host, user, dest_ip, dest_port, src_ip, src_port, event_id, process_id, process_name, process_path, signature, direction, protocol `hec_collect`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | "chrome.exe" |
| 1 | "firefox.exe" |
| 1 | "iexplorer.exe" |
| 1 | "opera.exe" |
| 1 | "MicrosoftEdge.exe" |